// Docs
How CIPHR actually works
CIPHR is a non-custodial payment card that settles on-chain without exposing who paid, who was paid, or what was left in the wallet. This page is the logic of the product — not a whitepaper substitute, the operating story.
The idea
A normal card tells a story: your name, your bank, your merchant, your balance. CIPHR is built so checkout still looks ordinary while the ledger stays quiet. The holder keeps the keys. The protocol never learns an identity. The contract never holds the money as an issuer float.
Robinhood Chain is the settlement network the contracts target. CIPHR is independent of Robinhood Markets — the chain is infrastructure, not a brand partnership.
Three moves
- 01 — Fund
Deposit into the pool
You send a supported asset from a wallet you already control. That deposit is public, the same way any on-chain transfer is public. After it lands, the trail stops.
- 02 — Shield
Mint a private note
The deposit becomes a commitment in a Merkle tree. Your spendable balance is a note you can prove you own without revealing which note it is. A zero-knowledge proof — not an account name — authorises every later spend.
- 03 — Spend
Pay from a fresh address
Each authorisation burns a nullifier and settles from a one-time stealth address. Two payments from the same card cannot be linked on the graph. The merchant sees a settlement; a chain analyst sees noise.
What the shielded pool is
The pool is the anonymity set. Notes live there as commitments. Spending a note requires a proof that you know the opening of some commitment in the tree, plus a nullifier that has not been seen before. Relayers can submit the proof so you do not leak your IP next to your spend.
No issuer holds the float. Freeze, rotate or burn a card is an instruction to the contract from your keys — not a ticket to support.
What $CIPHR is for
The token is the network asset for the shielded pool. It pays relayer fees, backs the anonymity set, and carries governance over circuit upgrades. The contract address on this site — the chip next to Connect Wallet — is the single source of truth. If it is empty, the token is not live yet. If it is set, copy it from here or from @ciphrcards and nowhere else.
Launch is on Pons, the bonding-curve launchpad on Robinhood Chain (chain id 4663). Until a curve graduates into a Uniswap pool, DexScreener and other DEX indexers often show no pair. The Token panel does not wait on them: it reads the Pons factory and the ERC-20 on-chain, then falls back to DexPaprika / DexScreener only after a pool exists.
Wallets
Connect Wallet is read-only. MetaMask, Phantom and Robinhood Wallet share a public address so the app can show a shielded balance. Nothing is stored on our servers. No transaction is signed just because you connected.